JetBrains TeamCity RCE Attempt

Try in Splunk Security Cloud

Description

The following analytic is designed to detect attempts to exploit the CVE-2023-42793 vulnerability in TeamCity On-Premises. It focuses on identifying suspicious POST requests to /app/rest/users/id:1/tokens/RPC2, which is the initial point of exploitation. This could indicate an unauthenticated attacker trying to gain administrative access through Remote Code Execution (RCE).

• Type: TTP
• Product: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
• Datamodel: Web
• Last Updated: 2023-10-01
• Author: Michael Haag, Splunk
• ID: 89a58e5f-1365-4793-b45c-770abbb32b6c

Annotations

ATT&CK

ATT&CK

ID	Technique	Tactic
T1190	Exploit Public-Facing Application	Initial Access

Kill Chain Phase

• Delivery

NIST

• DE.CM

CIS20

• CIS 13

CVE

ID	Summary	CVSS
CVE-2023-42793	In JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE on TeamCity Server was possible	None

Search

| tstats count min(_time) as firstTime max(_time) as lastTime from datamodel=Web where Web.url IN ("/app/rest/users/id:1/tokens/RPC2*") Web.status=200 Web.http_method=POST by Web.http_user_agent, Web.status Web.http_method, Web.url, Web.url_length, Web.src, Web.dest, sourcetype 
| `drop_dm_object_name("Web")` 
| `security_content_ctime(firstTime)` 
| `security_content_ctime(lastTime)` 
| `jetbrains_teamcity_rce_attempt_filter`

Macros

The SPL above uses the following Macros:

• security_content_ctime

jetbrains_teamcity_rce_attempt_filter is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.

Required fields

List of fields required to use this analytic.

• Web.http_user_agent
• Web.status
• Web.http_method
• Web.url
• Web.url_length
• Web.src
• Web.dest

How To Implement

The following analytic requires the Web datamodel. Ensure data source is mapped correctly or modify and tune for your data source.

Known False Positives

If TeamCity is not in use, this analytic will not return results. Monitor and tune for your environment.

Associated Analytic Story

• JetBrains TeamCity Unauthenticated RCE
• CISA AA23-347A
• JetBrains TeamCity Vulnerabilities

RBA

Risk Score	Impact	Confidence	Message
81.0	90	90	Potential JetBrains TeamCity RCE Attempt detected against URL $url$ on $dest$.

The Risk Score is calculated by the following formula: Risk Score = (Impact * Confidence/100). Initial Confidence and Impact is set by the analytic author.

Reference

• https://blog.jetbrains.com/teamcity/2023/09/critical-security-issue-affecting-teamcity-on-premises-update-to-2023-05-4-now/
• https://www.sonarsource.com/blog/teamcity-vulnerability/
• https://github.com/rapid7/metasploit-framework/pull/18408
• https://attackerkb.com/topics/1XEEEkGHzt/cve-2023-42793/rapid7-analysis

Test Dataset

Replay any dataset to Splunk Enterprise by using our replay.py tool or the UI. Alternatively you can replay a dataset into a Splunk Attack Range

source | version: 1